A dhr intelligent adjudication architecture system based on adaptive anomaly perception

Abstract

The application belongs to the technical field of network security, and discloses a DHR intelligent adjudication architecture system based on adaptive anomaly perception, which comprises an input / output module, an execution mechanism, a heterogeneous execution body pool, a component pool, an intelligent adjudication mechanism and a negative feedback mechanism. An intelligent anomaly perception mechanism is added to the DHR adjudication module to assist arbitration. The output result of the execution body is subjected to multi-feature extraction and multi-model training to obtain an optimal feature subset and an optimal training model, and then the anomaly score of the execution result of the execution body is obtained. The output result with an anomaly score higher than a threshold value is removed, and then multi-mode adjudication is performed. The reliability of the adjudication data is fully considered, the accuracy of the adjudication is improved, and the ability of the quasi-state defense system to resist common mode attacks is improved.

Description

Technical Field

[0001] This invention belongs to the field of network security technology, specifically relating to a method for constructing a DHR intelligent adjudication architecture based on adaptive anomaly perception. Background Technology

[0002] With the rise and development of internet technology and new service models, the construction of next-generation network infrastructure has gradually become widespread. Designers and developers are focusing more on performance, while network security has not received sufficient attention. Furthermore, security vulnerabilities caused by design flaws or vulnerabilities in software and hardware cannot be completely avoided. Software and hardware code with "hidden functions" intentionally designed by product providers or unintentionally introduced into the industry ecosystem cannot be completely eliminated. Because it is impossible to control the generalized uncertainties within software and hardware products in real time, the vulnerabilities or security flaws inherent in the design, manufacturing, and use of cyberspace software and hardware products, along with the rapid expansion of cyberspace, have made security threats a pervasive problem, spreading throughout the entire cyberspace.

[0003] To address these issues, researchers have proposed numerous defensive strategies. The United States was the first to propose Moving Target Defense (MTD), but MTD has inherent flaws. It only works on the "scanning and probing" phase of an attack, lacks versatility, and is cumbersome to construct, with frequent target movement leading to excessive resource consumption. In 2016, Academician Wu Jiangxing proposed Dynamic Heterogeneous Redundancy (DHR). This architecture, through the construction of a dynamically heterogeneous redundant mimicry system, enables network information systems to possess immunity, overturning the current imbalance between offense and defense in cyberspace. Due to the dynamic and random nature of mimicry defense, attackers perceive it as an unpredictable, spatiotemporal shift or rapid migration across diverse environments, making it difficult to observe and predict. This increases the difficulty and cost of attacks based on vulnerabilities and backdoors.

[0004] A key security feature of the DHR architecture is its intrusion tolerance, which largely relies on the adjudication mechanism's comprehensive judgment of the results from multiple executors. In the DHR architecture, the adjudication mechanism determines the redundant results output by heterogeneous executors and outputs the final correct result. As the final step before system output, the accuracy of the adjudication directly affects the reliability and availability of the architecture; a single incorrect judgment can trigger serious security problems. While large-number adjudication is simple in principle and fast in arbitration, it is vulnerable to coordinated attacks, which can lead to more than half of the executors being maliciously exploited, causing multi-modal adjudication to fail and the system to be successfully attacked. Summary of the Invention

[0005] To address the vulnerability of traditional architectures to coordinated attacks, which can lead to the malicious exploitation of more than half of the executors and render adjudication ineffective, and to compensate for the lack of a method for directly evaluating the reliability of the executor's output, this invention provides a DHR intelligent adjudication architecture system based on adaptive anomaly perception. This system improves the adjudication mechanism within the DHR architecture by adding an intelligent anomaly perception mechanism to the DHR adjudication module. It performs multi-feature extraction and multi-model training on the executor's output to obtain the optimal feature subset and optimal training model, thereby obtaining the anomaly score of the executor's execution result. Outputs with anomaly scores exceeding a threshold are eliminated before multi-model adjudication is performed. This approach fully considers the reliability of the adjudication data, improves the accuracy of adjudication, and enhances the mimicry defense system's ability to resist common-mode attacks.

[0006] To achieve the above objectives, the present invention is implemented through the following technical solution:

[0007] This invention is a DHR intelligent adjudication architecture system based on adaptive anomaly perception, the DHR intelligent adjudication architecture system comprising:

[0008] Input / Output Module: The input / output module is connected to the equipment in the power grid. The input module is responsible for distributing the equipment request into n parts and distributing them to n heterogeneous executors in the execution mechanism. The output module is responsible for returning the arbitration result fed back by the intelligent adjudication mechanism to the equipment.

[0009] Execution Mechanism: The execution mechanism contains n heterogeneous execution entities, where n is the system redundancy. The execution mechanism is dynamically scheduled by the scheduling strategy in the negative feedback mechanism. Each heterogeneous execution entity independently processes the requests from the input module and outputs the results. The execution mechanism sends the output results of each heterogeneous execution entity to the intelligent arbitration mechanism for arbitration.

[0010] Heterogeneous Execution Pool: The heterogeneous execution pool contains m functionally equivalent but structurally different execution entities, where m > n. After the negative feedback mechanism determines the scheduling strategy, it will select n heterogeneous execution entities from the heterogeneous execution pool to enter the execution mechanism.

[0011] Component pool: The component pool contains different sets of components. Components are selected to form an execution body through different construction rules, such as random selection or selection of a component with equal or unequal probability. A component is selected from each set to form a heterogeneous execution body and enter the heterogeneous execution body pool. The heterogeneity of the components largely determines the heterogeneity of the execution body.

[0012] Intelligent adjudication mechanism: The intelligent adjudication mechanism is mainly divided into two parts: intelligent anomaly perception module and multi-mode adjudication module. The intelligent anomaly perception module contains a deep learning model trained on abnormal traffic. It calculates anomaly scores for the output results of heterogeneous executors and determines whether the output results exceed the anomaly threshold based on the calculation results. If the threshold is exceeded, it is considered that the executor corresponding to the output results has encountered an unknown error or has been attacked. The output results need to be deleted and the negative feedback mechanism is notified to process the heterogeneous executor. Otherwise, the results are input to the multi-mode adjudication module for arbitration. The multi-mode adjudication module sends the final arbitration result to the output module and the negative feedback mechanism.

[0013] Negative feedback mechanism: The negative feedback mechanism is an important control link in the DHR intelligent adjudication architecture system. The negative feedback mechanism changes the scheduling strategy based on the feedback information of the intelligent adjudication mechanism and performs cleaning, reorganization and restoration operations on heterogeneous execution entities that have encountered unknown errors or been attacked.

[0014] A further improvement of the present invention is that the intelligent adjudication mechanism implements the adjudication process in the following specific steps:

[0015] Step 1: Connect the input module or output module to the equipment in the power grid. The input module is responsible for distributing the equipment request into n parts and distributing them to n heterogeneous executors in the execution mechanism. The output module is responsible for returning the arbitration result fed back by the intelligent adjudication mechanism to Step 2 to formulate the construction rules of the component pool.

[0016] Step 2: When the adjudication task is about to start, formulate the heterogeneous pool construction rules based on the results fed back by the negative feedback mechanism, select a component from each component pool to form a heterogeneous execution body and enter the heterogeneous execution body pool;

[0017] Step 3: When a decision task needs to be executed, the negative feedback mechanism determines the dynamic scheduling strategy and selects n executors from the heterogeneous executor pool to enter the execution mechanism, where n is the system redundancy.

[0018] Step 4: The execution mechanism contains n heterogeneous executors, which are dynamically scheduled by the scheduling strategy in the negative feedback mechanism. Each heterogeneous executor independently processes the requests from the input module and outputs the results. The execution mechanism sends the output results of each heterogeneous executor to the intelligent arbitration mechanism for arbitration.

[0019] Step 5: By introducing deep learning to intelligently detect anomalies in the output results of heterogeneous executors, and then combining it with the multi-mode arbitration module for arbitration, the reliability of the output results of heterogeneous executors is directly assessed.

[0020] Step 6: The negative feedback mechanism changes the scheduling strategy based on the feedback information from the intelligent adjudication mechanism, and performs cleaning, reorganization and restoration operations on the execution units that have encountered unknown errors or been attacked.

[0021] A further improvement of the present invention is that, in step 2, m heterogeneous executors are selected from the component pool and placed into the heterogeneous executor pool. The selection of heterogeneous executors specifically includes the following steps:

[0022] Step 21: Determine the types of components, and each type of component has multiple functionally equivalent but structurally different executors;

[0023] Step 22: Based on the results of the negative feedback mechanism in step 6, specify the construction rules for the heterogeneous execution pool that meet the system's security and efficiency.

[0024] Step 23: Each time a heterogeneous execution pool is built, select heterogeneous executions with high heterogeneity and that meet the requirements according to the established heterogeneous execution pool construction rules to avoid common-mode vulnerabilities.

[0025] A further improvement of the present invention is that the dynamic scheduling of the executor in step 3 includes the following steps:

[0026] Step 31: During each dynamic scheduling, calculate the historical confidence C of the executors in the heterogeneous executor pool. t and the heterogeneity between the implementers security The final scheduling reliability CHS is obtained. t ;

[0027] Step 32: Based on the scheduling reliability CHS t The heterogeneous executors in the heterogeneous executor pool are sorted, and the executor with the highest scheduling reliability is selected as the executor to be scheduled and enter the execution mechanism.

[0028] A further improvement of the present invention is that, in step 31, the historical confidence level of the executor is determined by the running result y of each executor. i,t System ruling result Y t And the number of times execution body i is scheduled by the deadline ζ i,t Decision, historical confidence level C t The calculation process is as follows

[0029] Heterogeneity between executors The heterogeneity matrix is ​​composed of the heterogeneity among heterogeneous implementers. The calculation process for isomerism is as follows: Ω n This represents the set of n execution entities in the heterogeneous execution entity pool;

[0030] Safety between executors A safety degree matrix consisting of the relative safety degrees among heterogeneous executors The calculation process for the safety level is as follows:

[0031] Scheduling reliability CHS t Then, with historical confidence level C t Heterogeneity and security They are positively correlated, and the calculation process for scheduling reliability is as follows:

[0032] A further improvement of the present invention is that: in step 5, the intelligent anomaly perception and multi-modal adjudication specifically include the following steps:

[0033] Step 51: Perform data preprocessing on the original data that needs to be adjudicated, so that the influence of each feature dimension on the objective function is the same, and use the minimax normalization method to map all original data features to the range [0,1].

[0034] Step 52: Extract features from the preprocessed dataset in Step 51, retain important data and delete redundant data, increase the weight of the selected features in subsequent deep learning training, and send the selected feature subset to the decision tree model for evaluation. Finally, select the optimal feature subset and the optimal feature extraction method suitable for this scenario.

[0035] Step 53: Train the model using deep learning methods, compare the output results of different models, and select the result of the optimal model as the final anomaly score calculation model;

[0036] Step 54: After determining the optimal anomaly score calculation model in Step 53, the output result a of the sigmoid function of the model classifier is used. i If we consider the abnormal scores of the output of execution body i as exceptions, then the set of abnormal scores is A = {a1, a2, ..., a...} n |0≤a i ≤1};

[0037] Step 55: After obtaining the anomaly score of each execution body's output result in step 54, the multi-mode adjudication based on the anomaly result screening compares the anomaly score of each output result with the preset threshold δ.

[0038] Step 56: When the abnormal score is greater than or equal to the threshold, it is considered that the execution unit has encountered an unknown error or has been successfully attacked. The output of the execution unit needs to be deleted and the negative feedback mechanism needs to be notified to replace and clean the execution unit.

[0039] Step 57: When the abnormal score is less than the threshold, the executor is considered to be operating normally, and the output of the executor enters the multi-mode adjudication stage.

[0040] Step 58: When the outlier scores of all output results are higher than the threshold or the smallest outlier A in A, min If the value is ≥0.6, it is considered that all executors output abnormal results, common-mode escape has occurred, and the system has been successfully attacked.

[0041] Step 59: When the abnormal scores of all output results are less than the threshold, the multi-mode decision based on abnormal results is equivalent to the traditional multi-mode decision.

[0042] A further improvement of the present invention is that: Step 51 specifically involves: The network traffic data features in step S51 are continuous and contain many redundant and useless data features. The dimensions and data levels of each feature differ significantly. Therefore, it is necessary to perform feature scaling on the original data so that each feature dimension has the same impact on the objective function. The minimax normalization method is used to map all original data features to the range [0,1]. Assuming X is the original data, X... normalization The normalized data is given by max(X) and min(X), which represent the maximum and minimum values ​​of each column feature in the original data.

[0043] A further improvement of the present invention is that, in step 52, features are extracted from the dataset using three feature extraction methods: Pearson correlation coefficient, tree-based feature selection, and recursive feature elimination. Important data is retained while redundant data is removed. The weight of the selected features is increased during subsequent model training. After the feature subset is selected, it is sent to the decision tree model for evaluation. Finally, the optimal feature subset and the optimal feature extraction method suitable for the scenario are selected.

[0044] A further improvement of the present invention is that, in step 53, multilayer perceptron (MLP), deep neural network (DNN), convolutional neural network (CNN), and recurrent neural network (RNN) are used for model training, and the output results of different models are compared to select the result of the optimal model as the final anomaly score calculation model.

[0045] A further improvement of the present invention is that step 6 specifically includes the following steps:

[0046] Step 61: Based on the outliers and adjudication results in Step 5, dynamically update the historical confidence level of the heterogeneous executors participating in the adjudication, and obtain the historical confidence level C of the executor when it enters the heterogeneous executor pool again. t+1 The dynamic update process of historical confidence is as follows: The results are then returned to step 31 to update the historical confidence level in real time.

[0047] Step 62: If the abnormal value in step 5 is too high or the running result of one or more execution units differs too much from the decision result, the execution unit is determined to be abnormal, and the execution unit is cleaned, reorganized and restored.

[0048] The beneficial effects of this invention are:

[0049] I. This invention provides a method for directly evaluating the reliability of the output results of an executor. This framework, based on multi-mode adjudication for anomaly result filtering, compares the anomaly score of each executor's output result with a pre-set threshold. A higher anomaly score indicates a greater probability of error in the output result, and a greater probability of the corresponding executor experiencing unknown errors or being successfully attacked. Output results exceeding the threshold are deleted, and multi-mode adjudication is performed to directly determine the reliability of the executor's output results, providing a more intuitive evaluation of the overall security and vulnerability of the DHR architecture.

[0050] Second, the adaptive anomaly perception model based on multi-feature extraction adopted in this invention requires training a suitable model based on the anomaly dataset. The trained model is used to determine whether the output of the execution body is abnormal, thereby improving the reliability of the adjudication data. This solves the problem in the prior art that the adjudication mechanism in the DHR architecture is simple in implementation principle, fast in arbitration speed, and easy to be attacked by coordinated attacks, resulting in more than half of the execution bodies being maliciously used, causing multi-mode adjudication to fail and the system to be successfully attacked.

[0051] Third, the dynamic scheduling mechanism of the present invention integrates the three indicators of historical confidence, heterogeneity and security to obtain the scheduling reliability index, and updates it dynamically, thereby enabling the negative feedback scheduling mechanism to have dynamic perception capability, further ensuring the dynamism and security of the system.

[0052] Fourth, this invention adds an intelligent anomaly perception module to the DHR architecture. The module contains a deep learning model trained on abnormal traffic, which can calculate the anomaly score of the execution unit's output and determine whether the output exceeds the anomaly threshold based on the calculation result. If it exceeds the threshold, the output is deleted and the negative feedback mechanism is notified to perform cleaning, reorganization and restoration operations on the execution unit. Otherwise, the result is input to the multi-mode arbitration part for arbitration, which improves the system's ability to perceive anomalies and ensures the stable operation of the system. Attached Figure Description

[0053] Figure 1 This is a flowchart illustrating the adjudication process implemented by the DHR intelligent adjudication architecture system of this invention.

[0054] Figure 2 This is a schematic diagram of the DHR intelligent adjudication architecture system of the present invention.

[0055] Figure 3 This is a schematic diagram of feature extraction according to the present invention.

[0056] Figure 4 This is a schematic diagram of the adaptive anomaly perception model of the present invention. Detailed Implementation

[0057] The embodiments of the present invention will be disclosed below with reference to the drawings. For clarity, many practical details will be described in the following description. However, it should be understood that these practical details are not intended to limit the invention. That is, in some embodiments of the invention, these practical details are not essential.

[0058] This invention is a DHR intelligent adjudication architecture system based on adaptive anomaly perception, comprising the following modules:

[0059] Input / Output Module: The input / output module is connected to the equipment in the power grid. The input module is responsible for distributing the equipment request into n parts and distributing them to n heterogeneous executors in the execution mechanism. The output module is responsible for returning the arbitration result fed back by the intelligent adjudication mechanism to the equipment.

[0060] Execution Mechanism: The execution mechanism contains n heterogeneous execution entities, where n is the system redundancy. The execution mechanism is dynamically scheduled by the scheduling strategy in the negative feedback mechanism. Each heterogeneous execution entity independently processes the requests from the input module and outputs the results. The execution mechanism sends the output results of each heterogeneous execution entity to the intelligent arbitration mechanism for arbitration.

[0061] Heterogeneous Execution Pool: The heterogeneous execution pool contains m functionally equivalent but structurally different execution entities, where m > n. After the negative feedback mechanism determines the scheduling strategy, it will select n heterogeneous execution entities from the heterogeneous execution pool to enter the execution mechanism.

[0062] Component pool: The component pool contains different sets of components. A component is selected from each set of components to form a heterogeneous execution body and enters the heterogeneous execution body pool through different construction rules. The heterogeneity of the components largely determines the heterogeneity of the execution body. The construction rules are to randomly select components to form an execution body, or to select a component with equal or unequal probability.

[0063] Intelligent adjudication mechanism: The intelligent adjudication mechanism is mainly divided into two parts: intelligent anomaly perception module and multi-mode adjudication module. The intelligent anomaly perception module contains a deep learning model trained on abnormal traffic. It calculates anomaly scores for the output results of heterogeneous executors and determines whether the output results exceed the anomaly threshold based on the calculation results. If the threshold is exceeded, it is considered that the executor corresponding to the output results has encountered an unknown error or has been attacked. The output results need to be deleted and the negative feedback mechanism is notified to process the heterogeneous executor. Otherwise, the results are input to the multi-mode adjudication module for arbitration. The multi-mode adjudication module sends the final arbitration result to the output module and the negative feedback mechanism.

[0064] Negative feedback mechanism: The negative feedback mechanism is an important control link in the DHR intelligent adjudication architecture system. The negative feedback mechanism changes the scheduling strategy based on the feedback information of the intelligent adjudication mechanism and performs cleaning, reorganization and restoration operations on heterogeneous execution entities that have encountered unknown errors or been attacked.

[0065] like Figure 1 As shown, the intelligent adjudication mechanism implements the adjudication process in the following specific steps:

[0066] Step 1: Connect the input module or output module to the equipment in the power grid. The input module is responsible for distributing the equipment request into n parts and distributing them to n heterogeneous executors in the execution mechanism. The output module is responsible for returning the arbitration result fed back by the intelligent adjudication mechanism to Step 2 to formulate the construction rules of the component pool.

[0067] Step 2: When the adjudication task is about to begin, formulate heterogeneous pool construction rules based on the results of the negative feedback mechanism, and select a component from each component pool to form a heterogeneous executor and enter it into the heterogeneous executor pool. In Step 2, m heterogeneous executors are selected from the component pools and placed into the heterogeneous executor pool. The selection of heterogeneous executors specifically includes the following steps:

[0068] Step 21: Determine the types of components, and each type of component has multiple functionally equivalent but structurally different executors;

[0069] Step 22: Based on the results of the negative feedback mechanism in step 6, specify the heterogeneous execution pool construction rules that meet the security and efficiency requirements of systems such as abnormal traffic monitoring systems and intelligent honeypot trapping systems;

[0070] Step 23: Each time a heterogeneous execution pool is built, select heterogeneous executions with high heterogeneity and that meet the requirements according to the established heterogeneous execution pool construction rules to avoid common-mode vulnerabilities.

[0071] Step 3: When a decision task needs to be executed, the negative feedback mechanism determines the dynamic scheduling strategy and selects n executors from the heterogeneous executor pool to enter the execution mechanism, where n is the system redundancy.

[0072] Dynamic scheduling of the executor includes the following steps:

[0073] Step 31: During each dynamic scheduling, calculate the historical confidence C of the executors in the heterogeneous executor pool. t and the heterogeneity between the implementers security The final scheduling reliability CHS is obtained. t The historical confidence level of an executor is determined by the execution results y of each executor. i,t System ruling result Y t And the number of times execution body i is scheduled by the deadline ζ i,t Decision, historical confidence level C t The calculation process is as follows

[0074] Heterogeneity between executors The heterogeneity matrix is ​​composed of the heterogeneity among heterogeneous implementers. The calculation process for isomerism is as follows: Ω n This represents the set of n execution entities in the heterogeneous execution entity pool;

[0075] Safety between executors A safety degree matrix consisting of the relative safety degrees among heterogeneous executors The calculation process for the safety level is as follows:

[0076] Scheduling reliability CHS t Then, with historical confidence level C t Heterogeneity and security They are positively correlated, and the calculation process for scheduling reliability is as follows:

[0077] Step 32: Based on the scheduling reliability CHS t The heterogeneous executors in the heterogeneous executor pool are sorted, and the executor with the highest scheduling reliability is selected as the executor to be scheduled and enter the execution mechanism.

[0078] Step 4: The execution mechanism contains n heterogeneous executors, which are dynamically scheduled by the scheduling strategy in the negative feedback mechanism. Each heterogeneous executor independently processes the requests from the input module and outputs the results. The execution mechanism sends the output results of each heterogeneous executor to the intelligent arbitration mechanism for arbitration.

[0079] Step 5: By introducing deep learning to intelligently detect anomalies in the output results of heterogeneous executors, and then combining it with the multi-mode arbitration module for arbitration, the reliability of the output results of heterogeneous executors is directly assessed.

[0080] like Figure 2 As shown, the intelligent adjudication mechanism is mainly divided into two parts: intelligent anomaly detection and multi-mode adjudication. The intelligent anomaly detection and multi-mode adjudication specifically include the following steps:

[0081] Step 51: Preprocess the original data to be adjudicated to ensure that each feature dimension has the same impact on the objective function. Use the minimax normalization method to map all original data features to the range [0,1]. Specifically:

[0082] Feature scaling is applied to the original data to ensure that each feature dimension has the same impact on the objective function. Mini-maximum normalization is then used to map all original data features to the range [0,1]. Let X be the original data. normalization The normalized data is given by max(X) and min(X), which represent the maximum and minimum values ​​of each column feature in the original data.

[0083] Step 52, as follows Figure 3 As shown, feature extraction is performed on the dataset after preprocessing in step 51. Important data is retained and redundant data is deleted. The weight of the selected features is increased during subsequent deep learning training. After the feature subset is selected, it is sent to the decision tree model for evaluation. Finally, the optimal feature subset and the optimal feature extraction method suitable for this scenario are selected.

[0084] The feature extraction process is as follows: features are extracted from the dataset using three methods: Pearson correlation coefficient, tree-based feature selection, and recursive feature elimination. Important data is retained while redundant data is removed. The weights of the selected features are increased during subsequent model training. After the feature subset is selected, it is sent to the decision tree model for evaluation. Finally, the optimal feature subset and the optimal feature extraction method suitable for this scenario are selected.

[0085] Step 53: Train the model using deep learning methods, compare the outputs of different models, and select the result of the optimal model as the final anomaly score calculation model. This invention uses Multilayer Perceptron (MLP), Deep Neural Network (DNN), Convolutional Neural Network (CNN), and Recurrent Neural Network (RNN) for model training, compares the outputs of different models, and selects the result of the optimal model as the final anomaly score calculation model.

[0086] Step 54, as follows Figure 4 As shown, after determining the optimal anomaly score calculation model in step 53, the output result a of the sigmoid function of the model classifier is used. i If we consider the abnormal scores of the output of execution body i as exceptions, then the set of abnormal scores is A = {a1, a2, ..., a...}n |0≤a i ≤1};

[0087] Step 55: After obtaining the anomaly score of each execution body's output result in step 54, the multi-mode adjudication based on the anomaly result screening compares the anomaly score of each output result with the preset threshold δ.

[0088] Step 56: When the abnormal score is greater than or equal to the threshold, it is considered that the execution unit has encountered an unknown error or has been successfully attacked. The output of the execution unit needs to be deleted and the negative feedback mechanism needs to be notified to replace and clean the execution unit.

[0089] Step 57: When the abnormal score is less than the threshold, the executor is considered to be operating normally, and the output of the executor enters the multi-mode adjudication stage.

[0090] Step 58: When the outlier scores of all output results are higher than the threshold or the smallest outlier A in A, min If the value is ≥0.6, it is considered that all executors output abnormal results, common-mode escape has occurred, and the system has been successfully attacked.

[0091] Step 59: When the abnormal scores of all output results are less than the threshold, the multi-mode decision based on abnormal results is equivalent to the traditional multi-mode decision.

[0092] Step 6: The negative feedback mechanism changes the scheduling strategy based on feedback information from the intelligent adjudication mechanism, performing cleaning, reorganization, and restoration operations on executors that have encountered unknown errors or been attacked. Specifically, this includes the following steps:

[0093] Step 61: Based on the outliers and adjudication results in Step 5, dynamically update the historical confidence level of the heterogeneous executors participating in the adjudication, and obtain the historical confidence level C of the executor when it enters the heterogeneous executor pool again. t+1 The dynamic update process of historical confidence is as follows: The results are then returned to step 31 to update the historical confidence level in real time.

[0094] Step 62: If the abnormal value in step 5 is too high or the running result of one or more execution units differs too much from the decision result, the execution unit is determined to be abnormal, and the execution unit is cleaned, reorganized and restored.

[0095] This adaptive anomaly-aware DHR intelligent adjudication architecture, compared to existing DHR architectures, provides a method for directly evaluating the reliability of the executor's output. This framework uses a multi-mode adjudication system based on anomaly detection to compare the anomaly score of each executor's output with a pre-set threshold. A higher anomaly score indicates a greater probability of error in the output, and a higher probability of the corresponding executor experiencing an unknown error or being successfully attacked. Outputs exceeding the threshold are deleted before multi-mode adjudication, directly assessing the reliability of the executor's output and providing a more intuitive evaluation of the overall security and vulnerability of the DHR architecture.

[0096] This adaptive anomaly-aware DHR intelligent adjudication architecture addresses the problem that while the adjudication mechanism in the DHR architecture is simple in implementation and fast in arbitration, it is vulnerable to coordinated attacks that can lead to more than half of the executors being maliciously exploited, causing multi-mode adjudication to fail and the system to be successfully attacked. The adaptive anomaly-aware model based on multi-feature extraction requires training a suitable model on an anomaly dataset. The trained model is then used to determine whether the output results of the executors are abnormal, thus improving the reliability of the adjudication data.

[0097] This adaptive anomaly-aware DHR intelligent adjudication architecture integrates three indicators—historical confidence, heterogeneity, and security—into a scheduling reliability index through its dynamic scheduling mechanism, and updates it dynamically. This gives the negative feedback scheduling mechanism dynamic awareness, further ensuring the system's dynamism and security.

[0098] This adaptive anomaly-aware DHR intelligent adjudication architecture adds an intelligent anomaly-aware module to the DHR architecture. This module contains a deep learning model trained on abnormal traffic, capable of calculating anomaly scores on the output of the executor. Based on the calculation result, it determines whether the output exceeds an anomaly threshold. If it does, the output is deleted, and a negative feedback mechanism is notified to perform cleaning, reorganization, and restoration operations on the executor; otherwise, the result is input to the multi-mode adjudication part for arbitration. This improves the system's ability to detect anomalies and ensures stable system operation.

[0099] The above description is merely a preferred embodiment of the present invention, and the scope of protection of the present invention is not limited to the above embodiments. All technical solutions falling within the scope of the present invention's concept are within the scope of protection of the present invention. It should be noted that for those skilled in the art, any improvements and modifications made without departing from the principle of the present invention should also be considered within the scope of protection of the present invention.

Claims

1. A DHR intelligent adjudication architecture system based on adaptive anomaly perception, characterized in that: The DHR intelligent adjudication architecture system includes Input / Output Module: The input / output module connects to equipment in the power grid. The input module is responsible for distributing equipment requests to... The copies are distributed to the execution mechanism. Each heterogeneous executor has an output module responsible for returning the arbitration result fed back by the intelligent adjudication mechanism to the device; Execution mechanism: The execution mechanism includes Heterogeneous executors To ensure system redundancy, the execution mechanism is dynamically scheduled by the scheduling strategy in the negative feedback mechanism. Each heterogeneous executor independently processes the requests from the input module and outputs the results. The execution mechanism sends the output results of each heterogeneous executor to the intelligent arbitration mechanism for arbitration. Heterogeneous Execution Pool: The heterogeneous execution pool contains There are three functionally equivalent but structurally different execution entities. After the negative feedback mechanism determines the scheduling strategy, it will select from the heterogeneous execution pool. A heterogeneous executor enters the execution mechanism; Component pool: The component pool contains different sets of components. Based on different construction rules, a component is selected from each set to form a heterogeneous execution body and enter the heterogeneous execution body pool. Intelligent adjudication mechanism: The intelligent adjudication mechanism is mainly divided into two parts: intelligent anomaly perception module and multi-mode adjudication module. The intelligent anomaly perception module contains a deep learning model trained on abnormal traffic. It calculates anomaly scores for the output results of heterogeneous executors and determines whether the output results exceed the anomaly threshold based on the calculation results. If the threshold is exceeded, it is considered that the executor corresponding to the output results has encountered an unknown error or has been attacked. The output results need to be deleted and the negative feedback mechanism is notified to process the heterogeneous executor. Otherwise, the results are input to the multi-mode adjudication module for arbitration. The multi-mode adjudication module sends the final arbitration result to the output module and the negative feedback mechanism. Negative Feedback Mechanism: The negative feedback mechanism is a crucial control element in the DHR intelligent adjudication architecture system. It adjusts the scheduling strategy based on feedback from the intelligent adjudication mechanism, performing cleaning, reorganization, and recovery operations on heterogeneous execution entities that have encountered unknown errors or been attacked. The dynamic scheduling of execution entities includes the following steps: Step 31: During each dynamic scheduling, calculate the historical confidence level of the executors in the heterogeneous executor pool. and the heterogeneity between the implementers Safety Finally, the scheduling reliability is obtained. ; Step 32: Based on scheduling reliability The heterogeneous executors in the heterogeneous executor pool are sorted, and the executor with the highest scheduling reliability is selected as the executor to be scheduled and enter the execution mechanism. In step 31, the historical confidence level of the executor is determined by the execution results of each executor. System ruling results and the execution body by the deadline Number of times scheduled Decision, historical confidence The calculation process is as follows ; Heterogeneity between executors The heterogeneity matrix is ​​composed of the heterogeneity among heterogeneous implementers. The calculation process for isomerism is as follows: , Indicating heterogeneous execution pool A collection of executors; Safety between executors A safety degree matrix consisting of the relative safety degrees among heterogeneous executors The calculation process for the safety level is as follows: ; Scheduling reliability Then with historical confidence Heterogeneity and security They are positively correlated, and the calculation process for scheduling reliability is as follows: .

2. The DHR intelligent adjudication architecture system based on adaptive anomaly perception according to claim 1, characterized in that: The intelligent adjudication mechanism implements the adjudication process in the following specific steps: Step 1: Connect the input module or output module to the equipment in the power grid. The input module is responsible for distributing the equipment requests to... The copies are distributed to the execution mechanism. Each heterogeneous executor has an output module responsible for returning the arbitration result fed back by the intelligent adjudication mechanism to step 2 to formulate the construction rules of the component pool. Step 2: When the adjudication task is about to start, formulate the heterogeneous pool construction rules based on the results fed back by the negative feedback mechanism, select a component from each component pool to form a heterogeneous execution body and enter the heterogeneous execution body pool; Step 3: When a decision-making task needs to be executed, the negative feedback mechanism determines a dynamic scheduling strategy and selects from the heterogeneous execution pool. Each executor enters the execution mechanism. For system redundancy; Step 4, the execution mechanism includes Each heterogeneous executor is dynamically scheduled by the scheduling strategy in the negative feedback mechanism. Each heterogeneous executor independently processes the requests from the input module and outputs the results. The execution mechanism sends the output results of each heterogeneous executor to the intelligent adjudication mechanism for arbitration. Step 5: By introducing deep learning to intelligently detect anomalies in the output results of heterogeneous executors, and then combining it with the multi-mode arbitration module for arbitration, the reliability of the output results of heterogeneous executors is directly assessed. Step 6: The negative feedback mechanism changes the scheduling strategy based on the feedback information from the intelligent adjudication mechanism, and performs cleaning, reorganization and restoration operations on the execution units that have encountered unknown errors or been attacked.

3. The DHR intelligent adjudication architecture system based on adaptive anomaly perception according to claim 2, characterized in that: In step 2, select from the component pool. Each heterogeneous executor is placed into the heterogeneous executor pool. The selection of heterogeneous executors specifically includes the following steps: Step 21: Determine the types of components, and each type of component has multiple functionally equivalent but structurally different executors; Step 22: Based on the results of the negative feedback mechanism in step 6, specify the construction rules for the heterogeneous execution pool that meet the system's security and efficiency. Step 23: Each time a heterogeneous execution pool is built, select heterogeneous executions with high heterogeneity and that meet the requirements according to the established heterogeneous execution pool construction rules to avoid common-mode vulnerabilities.

4. The DHR intelligent adjudication architecture system based on adaptive anomaly perception according to claim 1, characterized in that: Step 5, intelligent anomaly detection and multi-modal adjudication, specifically includes the following steps: Step 51: Preprocess the original data to be adjudicated to ensure that each feature dimension has the same impact on the objective function. Use the minimax normalization method to map all original data features to... between; Step 52: Extract features from the preprocessed dataset in Step 51, retain important data and delete redundant data, increase the weight of the selected features in subsequent deep learning training, and send the selected feature subset to the decision tree model for evaluation. Finally, select the optimal feature subset and the optimal feature extraction method suitable for this scenario. Step 53: Train the model using deep learning methods, compare the output results of different models, and select the result of the optimal model as the final anomaly score calculation model; Step 54: After determining the optimal anomaly score calculation model in Step 53, use the output of the sigmoid function of the model classifier. Considered to be the executor The output includes the outlier scores, so the set of outlier scores is: ; Step 55: After obtaining the anomaly score of each executor's output in step 54, the multi-mode adjudication based on anomaly result filtering compares the anomaly score of each output with a pre-set threshold. Compare; Step 56: When the abnormal score is greater than or equal to the threshold, it is considered that the execution unit has encountered an unknown error or has been successfully attacked. The output of the execution unit needs to be deleted and the negative feedback mechanism needs to be notified to replace and clean the execution unit. Step 57: When the abnormal score is less than the threshold, the executor is considered to be operating normally, and the output of the executor enters the multi-mode adjudication stage. Step 58: When the anomaly scores of all output results are higher than the threshold or Minimum outlier If this happens, it is considered that all executors output abnormal results, common-mode escape has occurred, and the system has been successfully attacked. Step 59: When the abnormal scores of all output results are less than the threshold, the multi-mode decision based on abnormal results is equivalent to the traditional multi-mode decision.

5. The DHR intelligent adjudication architecture system based on adaptive anomaly perception according to claim 4, characterized in that: Step 51 specifically involves: scaling the features of the original data so that each feature dimension has the same impact on the objective function; and using the minimax normalization method to map all the original data features to... Between, assuming The original data, For the normalized data, and This represents the maximum and minimum values ​​of each column feature in the original data. The normalized data is... .

6. The DHR intelligent adjudication architecture system based on adaptive anomaly perception according to claim 4, characterized in that: In step 52, features are extracted from the dataset using three feature extraction methods: Pearson correlation coefficient, tree-based feature selection, and recursive feature elimination. Important data is retained while redundant data is removed. The weights of the selected features are increased during subsequent model training. After the feature subset is selected, it is sent to the decision tree model for evaluation. Finally, the optimal feature subset and the optimal feature extraction method suitable for this scenario are selected.

7. The DHR intelligent adjudication architecture system based on adaptive anomaly perception according to claim 4, characterized in that: In step 53, multilayer perceptron (MLP), deep neural network (DNN), convolutional neural network (CNN), and recurrent neural network (RNN) were used to train the model, and the output results of different models were compared. The result of the optimal model was selected as the final anomaly score calculation model.

8. The DHR intelligent adjudication architecture system based on adaptive anomaly perception according to claim 1, characterized in that: Step 6 specifically includes the following steps: Step 61: Dynamically update the historical confidence of the heterogeneous executors participating in the adjudication based on the outliers and adjudication results in Step 5, to obtain the historical confidence of the executor when it enters the heterogeneous executor pool again. The dynamic update process of historical confidence is as follows: The results are then returned to step 31 to update the historical confidence level in real time. Step 62: If the abnormal value in step 5 is too high or the running result of one or more execution units differs too much from the decision result, the execution unit is determined to be abnormal, and the execution unit is cleaned, reorganized and restored.

Images